If you debootstrap a brand new trixie install today, you will get not just a vulnerable kernel but also a vulnerable libssl3t64 missing patches for 6 CVEs including a heap buffer overflow and a use after free. I'm not really a debian expert but this seems... not.. good?